CVE-2026-46444: Flowise: Vector Store No Permission Checks

Synopsis

This is an authentication bypass (missing permission checks) in Flowise, the drag-and-drop LLM flow builder. The /api/v1/openai-assistants-vector-store endpoint is reachable over the network with only a low-privilege API key and performs no permission checks on any CRUD operation, meaning any authenticated API key holder can read, create, update, or delete vector store data regardless of their intended access level. Successful exploitation gives an attacker full read, write, and delete control over OpenAI Assistants Vector Store contents. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Flowise API service via HTTP.

• AuthenticationRequired

  Any valid low-privilege API key is sufficient; no admin or elevated account is needed, but some credential is required.

• Victim interactionNot required

  The attacker can send requests directly to the API with no user interaction needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions or special environmental factors are required to trigger the missing permission checks.

Blast Radius

• Reads all vector store data associated with OpenAI Assistants, including embedded document chunks and associated metadata.
• Creates or overwrites vector store entries, injecting arbitrary content into the LLM's retrieval context.
• Deletes existing vector store data, permanently removing knowledge base content that the LLM depends on.
• Disrupts the availability of any Flowise flow that relies on the affected vector store by corrupting or emptying its contents.